CVE-2026-100390
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.
Debilidad
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.
Referencias
- https://github.com/tobychui/zoraxy
- https://github.com/tobychui/zoraxy/blob/v3.3.4/src/mod/auth/sso/forward/util.go#L127-L142
- https://github.com/tobychui/zoraxy/commit/56bb3e5abb83eae42a64203028d73a001d6096c4
- https://github.com/tobychui/zoraxy/pull/1264
- https://www.vulncheck.com/advisories/zoraxy-3.2.3-through-3.3.4-client-ip-spoofing-via-x-forwarded-for-ipv6
Encuentra el fallo antes que un atacante.
Inicia sesión con GitHub y ejecuta tu primera auditoría en menos de un minuto. El plan gratuito no requiere tarjeta de crédito.